Security Advisory WSO2-2016-0159

Published: November 08, 2016


  • WSO2 API Manager 2.0.0
  • WSO2 APP Manager 1.2.0
  • WSO2 Application Server 5.3.0
  • WSO2 Business Process Server 3.6.0,
  • WSO2 Business Rules Server 2.2.0
  • WSO2 Complex Event Processor, 4.2.0
  • WSO2 Data Analytics Server 3.1.0
  • WSO2 Dashboard Server 2.0.0
  • WSO2 Data Services Server 3.5.1
  • WSO2 Enterprise Mobility Manager 3.0.1
  • WSO2 Enterprise Store 2.1.0
  • WSO2 Enterprise Service Bus 5.0.0
  • WSO2 Governance Registry 5.3.0
  • WSO2 Identity Server 5.2.0
  • WSO2 Message Broker, 3.1.0
  • WSO2 Machine Learner 1.2.0


Management Console of WSO2 products cache sensitive data in browsers and intermediary proxies.


When a user browses a page where it contains some sensitive data and logout from the management console, still users can go back (by using the browser's Back button) and view that page without login in due to browser cache.


Non-privileged users can view sensitive information through the management console.


For WSO2 Update Manager (WUM) Supported Products

Use WUM to update the following products.

Code Product Version
AM WSO2 API Manager 2.0.0
DSS WSO2 Data Services Server 3.5.1
ESB WSO2 Enterprise Service Bus 5.0.0
IS WSO2 Identity Server 5.2.0


If you are not yet using WUM, you can still update the DSS 3.5.1 product by manually applying the patches referring to the below section.

For Other Products

Apply the following patches based on your products by following the instructions in the README file. Patches can also be downloaded from Security Patch Releases. If you have any questions, post them to

Code Product Version Patch
APPM WSO2 App Manager 1.2.0 WSO2-CARBON-PATCH-4.4.0-0536
AS WSO2 Application Server 5.3.0 WSO2-CARBON-PATCH-4.4.0-0531
BPS WSO2 Business Process Server 3.6.0 WSO2-CARBON-PATCH-4.4.0-0537
BRS WSO2 Business Rules Server 2.2.0 WSO2-CARBON-PATCH-4.4.0-0533
CEP WSO2 Complex Event Processor 4.2.0 WSO2-CARBON-PATCH-4.4.0-0538
DAS WSO2 Data Analytics Server 3.1.0 WSO2-CARBON-PATCH-4.4.0-0538
DS WSO2 Dashboard Server 2.0.0 WSO2-CARBON-PATCH-4.4.0-0533
DSS WSO2 Data Services Server 3.5.1 WSO2-CARBON-PATCH-4.4.0-0538
EMM WSO2 Enterprise Mobility Manager 2.0.1 WSO2-CARBON-PATCH-4.4.0-0533
ES WSO2 Enterprise Store 2.1.0 WSO2-CARBON-PATCH-4.4.0-0536
GREG WSO2 Governance Registry 5.3.0 WSO2-CARBON-PATCH-4.4.0-0536
MB WSO2 Message Broker 3.1.0 WSO2-CARBON-PATCH-4.4.0-0533
ML WSO2 Machine Learner 1.2.0 WSO2-CARBON-PATCH-4.4.0-0538


If you are using newer versions of the products than the ones mentioned in the "SOLUTION" section, this vulnerability is fixed.